linux-kernel - Re: [PATCH]early: Fix possible overlapping data buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 11 Mar 2011 08:42:51 +0100
From:	Heiko Carstens <heiko.carstens@...ibm.com>
To:	chenliu@...et.uwaterloo.ca
Cc:	schwidefsky@...ibm.com, linux390@...ibm.com, cotte@...ibm.com,
	linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH]early: Fix possible overlapping data buffer

On Thu, Mar 10, 2011 at 12:33:37PM -0500, chenliu@...et.uwaterloo.ca wrote:
> This patch fixes bugzilla #12965:
> https://bugzilla.kernel.org/show_bug.cgi?id=12965

Not sure it's worth all the hazzle. After all it's just a theoratical bug,
but...

> The original code contains dangerous uses of sprintf functions like
> sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13", defsys_cmd, min_size),
> where defsys_cmd is used both as input string as well as output string. It
> should remember the written bytes of the previous sprintf and use that as the
> offset when adding something. Also use snprintf makes the code safer.
> 
> Signed-off-by: Chen Liu<chenliunju@...il.com>

Please make sure your From: and Sign-off email addresses match.
Also it would be nice if you could add some line breaks in your patch
description ;)

Also it would be good to know if you tested the patch. Does saving
an NSS still work with your patch applied?

> ---
>  arch/s390/kernel/early.c |    9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
> --- a/arch/s390/kernel/early.c
> +++ b/arch/s390/kernel/early.c
> @@ -94,6 +94,7 @@ static noinline __init void create_kerne
>  	unsigned int sinitrd_pfn, einitrd_pfn;
>  #endif
>  	int response;
> +	int hlen;
>  	size_t len;
>  	char *savesys_ptr;
>  	char defsys_cmd[DEFSYS_CMD_SIZE];
> @@ -124,7 +125,7 @@ static noinline __init void create_kerne
>  	end_pfn = PFN_UP(__pa(&_end));
>  	min_size = end_pfn << 2;
> 
> -	sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
> +	hlen = sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
>  		kernel_nss_name, stext_pfn - 1, stext_pfn, eshared_pfn - 1,
>  		eshared_pfn, end_pfn);

Your patch introduced a new line with more than 80 characters long. You also
broke indentation since we have a multiline function call with parameters here.
In addition you add snprintf calls later. Why not here?
The checkpatch tool might give you some hints.


> @@ -133,13 +134,13 @@ static noinline __init void create_kerne
>  		sinitrd_pfn = PFN_DOWN(__pa(INITRD_START));
>  		einitrd_pfn = PFN_UP(__pa(INITRD_START + INITRD_SIZE));
>  		min_size = einitrd_pfn << 2;
> -		sprintf(defsys_cmd, "%s EW %.5X-%.5X", defsys_cmd,
> +		hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen, " EW %.5X-%.5X",
>  		sinitrd_pfn, einitrd_pfn);

Line too long. Plus indentation broken (well, it was already broken).
If you add an snprintf() call, then you should also make sure that the
resulting string is '\0' terminated.

>  	}
>  #endif
> 
> -	sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13",
> -		defsys_cmd, min_size);
> +	hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen, " EW MINSIZE=%.7iK PARMREGS=0-13",
> +		min_size);

Line too long and indentation broken. Also again you need to make sure that
the string is '\0' terminated.
In addition hlen is unused afterwards. So no need to update it here.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/